Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID

Also known as GHSA-vfxj-qg93-7wwc

Published 8 y ago 2018-04-17 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.1%

percentile 67%

Public exploits

none known

An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

Exploit prediction (EPSS)

1.14% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`mautic/core`	<2.13.0	2.13.0

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /mautic/mautic/releases/tag/2.13.0 · x_refsource_CONFIRM, x_transferred
github.com /mautic/mautic/security/advisories/GHSA-vfxj-qg93-7wwc · web
nvd.nist.gov /vuln/detail/CVE-2018-10189 · advisory

Sources

CVE List: CVE-2018-10189
GitHub Advisory: GHSA-vfxj-qg93-7wwc
NVD: CVE-2018-10189

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.